CVE-2026-76461

What is Cisco Secure Email Gateway?

Cisco Secure Email Gateway (formerly the Email Security Appliance, ESA), running the AsyncOS operating system, is a mail-filtering gateway that inspects inbound and outbound email for spam, malware, phishing, and data-loss-prevention violations. It is deployed as a physical appliance, a virtual appliance, or a cloud service, and it sits directly in the path of internet email. That placement is what makes a bug here unusually dangerous: the appliance must parse untrusted, attacker-supplied messages as its normal job, so an attacker does not need any account or management access to reach the vulnerable code.

Overview

CVE-2026-76461 is a CVSS 9.8 SQL injection (CWE-89) in the AsyncOS email-parsing logic of Cisco Secure Email Gateway. An unauthenticated attacker can send a specially crafted email that carries malicious SQL, and successful exploitation yields arbitrary command execution as root on the underlying operating system. Cisco disclosed the flaw on 2026-09-14 while confirming active exploitation, and CISA added it to KEV the same day with a three-day deadline.

Affected Versions

The flaw affects on-premises physical and virtual Secure Email Gateway appliances; some reporting also lists Cisco Secure Email Cloud as affected. There are no workarounds, and Cisco recommends moving to 16.5.0-780 where possible.

Technical Details

While parsing certain fields of an incoming email message, AsyncOS insufficiently validates the input before it is incorporated into a database query. An attacker who crafts a message with malicious SQL statements in the vulnerable field can break out of the intended query context (classic CWE-89 SQL injection). Because the database and the parsing service run with high privilege on the appliance, the injection can be leveraged into command execution as root on the underlying OS.

Attack characteristics:

• Authentication: none; the attacker only needs to send email to the gateway
• Complexity: low
• Vector: network, via normal SMTP mail flow
• Impact: root command execution (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

This "malicious email as the exploit" delivery is what makes the vulnerability especially serious: the gateway processes the attack automatically, without any user opening the message.

Discovery

Cisco identified the vulnerability while resolving a Technical Assistance Center (TAC) support case, tracked as Cisco bug CSCwu56234. As with the concurrent Cisco ISE disclosures, that origin means a real customer environment was already affected before Cisco pinned down the root cause.

Exploitation Context

Cisco PSIRT became aware of active exploitation in September 2026 and published the advisory the same day the CVE was added to KEV, indicating zero-day exploitation before public disclosure. As of 2026-09-16 there is no published proof of concept, no named threat actor, and no public exposure count. Cisco warns that because exploitation grants root, an attacker can alter or erase on-device logs, so absence of local evidence does not prove the appliance was untouched.

Remediation

1. Patch to the first fixed release for your train (see table) immediately. There is no workaround.
2. Review mail_logs for anomalous entries and for SQL-like content in parsed message fields around and before your patch date.
3. Corroborate with off-box telemetry. Because root access allows log tampering, check upstream firewall, proxy, and NetFlow records for unexpected outbound connections from the appliance to unfamiliar external hosts.
4. Inspect the appliance for persistence if you find any indicator: unexpected processes, cron entries, modified system binaries, or new administrator accounts. Engage Cisco TAC for appliance forensics if compromise is suspected, since normal admin tooling may not reveal a root-level implant.
5. Restrict management interfaces to trusted networks as general hardening, though note this does not mitigate the vulnerability itself, which is reachable through mail flow.